Version 9 (modified by Ryan J Ollos, 5 years ago) (diff)

Refs #10881.

Force HTTP authentication from within Trac


Allows you to protect certain paths with HTTP authentication. The AccountManagerPlugin is used to check passwords.

Primarily this is meant to be used with the XmlRpcPlugin so it will work while using AccountManager's form-based logins.

Bugs/Feature Requests

Existing bugs and feature requests for HttpAuthPlugin are here.

If you have any issues, create a new ticket.


Download the zipped source from [download:httpauthplugin here].


You can check out HttpAuthPlugin from here using Subversion, or browse the source with Trac. The version in 0.10 is also working with release, at least with mod_python.


To enable:

httpauth.* = enabled

To add additional paths:

paths = /xmlrpc, /login/xmlrpc

To add additional formats, like rss use this:

formats = rss


Authentication issues while using Trac with mod_wsgi


HTTP authentication just does not want to work. The Authorization header is passed with the HTTP request, but it seems to be lost on the way.

If you set the loglevel to INFO, then you will get this entry in your trac.log:

Trac[filter] INFO: HTTPAuthFilter: No/bad authentication data given, returing 403

It is already in Ticket #1169. I've quoted it here, since the solution is hard to find otherwise.


If you're using mod_wsgi, authorization information is stripped before passing to the WSGI application.


Turn WSGIPassAuthorization On in your Apache configuration for it to work.

See also ConfigurationDirectives

Recent Changes

16759 by rjollos on 2017-08-25 18:53:03
TracHTTPAuth 1.2: Run autopep8 on codebase
12656 by txcraig on 2013-02-24 13:55:10
#10881 Added maintainer and maintainer_email setting after adopting HttpAuthPlugin
12394 by jun66j5 on 2012-11-29 17:26:08
Fixed broken communication between client on tracd using HTTP/1.1 if sending 401 Unauthorized. Sends Connection: close header in this case.

Closes #8558.



Author: coderanger
Maintainer: txcraig